/**
 * olam mcp add <service> — Add a static-key MCP credential.
 *
 * Uses raw-mode readline to suppress echo so the token never appears in
 * terminal scrollback or shell history (OQ2 resolution).
 */
import * as readline from 'node:readline';
import { printError, printSuccess, printInfo } from '../../output.js';
import { getMcpAuthClient } from './client.js';
async function readTokenSilent(prompt) {
    return new Promise((resolve, reject) => {
        const rl = readline.createInterface({
            input: process.stdin,
            output: process.stdout,
            terminal: true,
        });
        process.stdout.write(prompt);
        // Suppress echo via raw mode
        if (process.stdin.isTTY) {
            process.stdin.setRawMode(true);
        }
        let token = '';
        process.stdin.on('data', function onData(chunk) {
            const char = chunk.toString('utf8');
            if (char === '\r' || char === '\n') {
                if (process.stdin.isTTY)
                    process.stdin.setRawMode(false);
                process.stdin.removeListener('data', onData);
                process.stdout.write('\n');
                rl.close();
                resolve(token);
            }
            else if (char === '') {
                if (process.stdin.isTTY)
                    process.stdin.setRawMode(false);
                process.stdin.removeListener('data', onData);
                rl.close();
                reject(new Error('Cancelled'));
            }
            else if (char === '') {
                // Backspace
                token = token.slice(0, -1);
            }
            else {
                token += char;
            }
        });
    });
}
export function registerMcpAdd(cmd) {
    cmd
        .command('add <service>')
        .description('Add a static-key MCP credential (token input hidden from terminal)')
        .option('--token <token>', 'Token value (use stdin prompt if omitted)')
        .option('--label <label>', 'Human-friendly label')
        .option('--env-name <envName>', 'Environment variable name to inject into worlds')
        .action(async (service, opts) => {
        let token = opts.token;
        if (!token) {
            try {
                token = await readTokenSilent(`Enter token for ${service} (hidden): `);
            }
            catch (err) {
                printError(err instanceof Error ? err.message : 'Cancelled');
                process.exitCode = 1;
                return;
            }
        }
        if (!token) {
            printError('Token is required');
            process.exitCode = 1;
            return;
        }
        const client = getMcpAuthClient();
        const result = await client.staticAdd({ service, token, label: opts.label, envName: opts.envName });
        if (!result.ok) {
            printError(result.error ?? 'Failed to add credential');
            process.exitCode = 1;
            return;
        }
        printSuccess(`Added ${service} credential`);
        if (opts.envName) {
            printInfo('Env var', opts.envName);
        }
    });
}
//# sourceMappingURL=add.js.map